blob: b089ac3b3544fa2e48dc4856bdf7a19cd888cc2b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
#!/bin/sh
set -o pipefail
MAIN=/usr/share/firewall4/main.uc
LOCK=/var/run/fw4.lock
STATE=/var/run/fw4.state
VERBOSE=
[ -e /dev/stdin ] && STDIN=/dev/stdin || STDIN=/proc/self/fd/0
[ -t 2 ] && export TTY=1
die() {
[ -n "$QUIET" ] || echo "$@" >&2
exit 1
}
start() {
{
flock -x 1000
case "$1" in
start)
[ -f $STATE ] && die "The fw4 firewall appears to be already loaded."
;;
reload)
[ ! -f $STATE ] && die "The fw4 firewall does not appear to be loaded."
# Delete state to force reloading ubus state
rm -f $STATE
;;
esac
ACTION=start \
utpl -S $MAIN | nft $VERBOSE -f $STDIN
} 1000>$LOCK
}
print() {
ACTION=print \
utpl -S $MAIN
}
stop() {
{
flock -x 1000
if nft list tables inet | grep -sq "table inet fw4"; then
nft delete table inet fw4
rm -f $STATE
else
return 1
fi
} 1000>$LOCK
}
flush() {
{
flock -x 1000
local dummy family table
nft list tables | while read dummy family table; do
nft delete table "$family" "$table"
done
rm -f $STATE
} 1000>$LOCK
}
reload_sets() {
ACTION=reload-sets \
flock -x $LOCK utpl -S $MAIN | nft $VERBOSE -f $STDIN
}
lookup() {
ACTION=$1 OBJECT=$2 DEVICE=$3 \
flock -x $LOCK utpl -S $MAIN
}
while [ -n "$1" ]; do
case "$1" in
-q)
export QUIET=1
shift
;;
-v)
export VERBOSE=-e
shift
;;
*)
break
;;
esac
done
case "$1" in
start|reload)
start "$1"
;;
stop)
stop || die "The fw4 firewall does not appear to be loaded, try fw4 flush to delete all rules."
;;
flush)
flush
;;
restart)
stop || rm -f $STATE
start
;;
print)
print
;;
reload-sets)
reload_sets
;;
network|device|zone)
lookup "$@"
;;
*)
cat <<EOT
Usage:
$0 [-v] [-q] start|stop|flush|restart|reload
Start, stop, flush, restart or reload the firewall respectively.
$0 [-v] [-q] reload-sets
Reload the contents of all declared sets but do not touch the
ruleset.
$0 [-q] print
Print the rendered ruleset.
$0 [-q] network {net}
Print the name of the firewall zone covering the given network.
Exits with code 1 if the network is not found or if no zone is
covering it.
$0 [-q] device {dev}
Print the name of the firewall zone covering the given device.
Exits with code 1 if the device is not found or if no zone is
covering it.
$0 [-q] zone {zone} [dev]
Print all covered devices of the given zone, optionally restricted
to only the given device name.
Exits with code 1 if zone is not found or if a device is specified
and not covered by the given zone.
EOT
;;
esac
|
